[Paper Review] A Systematic Security Analysis for Path-based Traceability Systems in RFID-Enabled Supply Chains

Fokke Heikamp, Lei Pan+3 more|arXiv (Cornell University)|Jan 14, 2026

Food Supply Chain Traceability0 citations

TL;DR

The paper proposes a security framework for path-based traceability in RFID-enabled supply chains, and evaluates 17 traceability solutions to reveal several vulnerabilities including path privacy and out-of-order attacks.

ABSTRACT

Traceability systems have become prevalent in supply chains because of the rapid development of RFID and IoT technologies. These systems facilitate product recall and mitigate problems such as counterfeiting, tampering, and theft by tracking the manufacturing and distribution life-cycle of a product. Therefore, traceability systems are a defense mechanism against supply chain attacks and, consequently, have become a target for attackers to circumvent. For example, a counterfeiter may change the trace of a fake product for the trace of an authentic product, fooling the system into accepting a counterfeit product as legit and thereby giving a false sense of security. This systematic analysis starts with the observation that security requirements in existing traceability solutions are often unstructured or incomplete, leaving critical vulnerabilities unaddressed. We synthesized the properties of current state-of-the-art traceability solutions within a single security framework that allows us to analyze and compare their security claims. Using this framework, we objectively compared the security of $17$ traceability solutions and identified several weaknesses and vulnerabilities. This article reports on these flaws, the methodology we used to identify them, and the first security evaluation of traceability solutions on a large scale.

Motivation & Objective

• Motivate the need for structured security analysis of RFID-enabled traceability systems.
• Define a unified security framework for path-based traceability that captures spatial and temporal path properties.
• Assess the security of 17 prominent traceability solutions against path-based attacks and privacy concerns.
• Identify common weaknesses and provide insights for more secure traceability designs.

Proposed method

• Model traceability systems as a tuple (R, T, B, ds, I) representing readers, tags, back-ends, data-sharing server, and issuer.
• Define behavior semantics via traces and formalize path-based properties: sound, complete, sorted, and authorized paths.
• Develop a taxonomy of path-based attacks (out-of-order, skip-step, reroute, ghost-step) and map them to path properties.
• Adopt adversary models Adv_T (tag compromise) and Adv_R (reader compromise) under Dolev-Yao assumptions to test security claims.
• Apply a two-step methodology: generic vulnerability identification, then formal security evaluation against the path-based framework.

Figure 1. Our RFID-enabled Traceability Model

Experimental results

Research questions

• RQ1 What are the essential path-based security properties required for a sound traceability system?
• RQ2 To what extent do existing RFID-based traceability solutions satisfy soundness, completeness, and authorization under realistic adversaries?
• RQ3 Which concrete weaknesses and attack vectors are present across prominent traceability designs?
• RQ4 How can a unified framework facilitate objective comparison and guide secure traceability design?

Key findings

• Evaluated 17 traceability solutions and identified multiple weaknesses and vulnerabilities.
• Found several attacks: linking attack on RF-Chain, path authorization attack on Burbridge and Soppera, out-of-order attacks on Ray et al. and Tracker, and a key-disclosure attack on ReSC.
• All systems were vulnerable to rerouting attacks with passive readers.
• Many solutions failed to enforce path order or complete path documentation under adversarial models.
• Some solutions did not clearly explain how path authorization policies are distributed or enforced.

Figure 2. Taxonomy for Path-based Attacks